Read the docs
TI-2019-16050 Aliases CVE-2019-1010266GHSA-x5rq-j2xg-h7qm

Uncontrolled resource consumption in lodash

Priority LOW 34CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Why it matters now

EPSS 0.02982 87th percentileScored 2026-11-07
Fix Fixed lodash (npm): 4.17.11lodash-es (npm): 4.17.11+2 more productsRed Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
lodashlodash<4.17.11 [fixed: 4.7.11]—No fix listedCNA
—lodash (npm)4.7.0 to before 4.17.114.17.11Patch availableGHSA-x5rq-j2xg-h7qm
—lodash-es (npm)4.7.0 to before 4.17.114.17.11Patch availableGHSA-x5rq-j2xg-h7qm
—lodash-amd (npm)4.7.0 to before 4.17.114.17.11Patch availableGHSA-x5rq-j2xg-h7qm
—lodash-rails (RubyGems)4.7.0 to before 4.17.114.17.11Patch availableGHSA-x5rq-j2xg-h7qm
  • lodash Vendorlodash Affected <4.17.11 [fixed: 4.7.11] Fixed in — No fix listed CNA
  • lodash (npm) Vendor— Affected 4.7.0 to before 4.17.11 Fixed in 4.17.11 Patch available GHSA-x5rq-j2xg-h7qm
  • lodash-es (npm) Vendor— Affected 4.7.0 to before 4.17.11 Fixed in 4.17.11 Patch available GHSA-x5rq-j2xg-h7qm
  • lodash-amd (npm) Vendor— Affected 4.7.0 to before 4.17.11 Fixed in 4.17.11 Patch available GHSA-x5rq-j2xg-h7qm
  • lodash-rails (RubyGems) Vendor— Affected 4.7.0 to before 4.17.11 Fixed in 4.17.11 Patch available GHSA-x5rq-j2xg-h7qm

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:*before 4.17.11Vulnerablelodash
  • cpe:2.3:a:lodash:lodash:*:*:*:*:*:node.js:*:* Versions before 4.17.11 Vulnerable ·lodash

Remediation

  • Fix · GHSA-x5rq-j2xg-h7qm lodash (npm) Fixed in 4.17.11 Advisory →
  • Fix · GHSA-x5rq-j2xg-h7qm lodash-es (npm) Fixed in 4.17.11 Advisory →
  • Fix · GHSA-x5rq-j2xg-h7qm lodash-amd (npm) Fixed in 4.17.11 Advisory →
  • Fix · GHSA-x5rq-j2xg-h7qm lodash-rails (RubyGems) Fixed in 4.17.11 Advisory →

Red Hat 1 advisory

  • RHSA-2021:3917 Released 2021-10-19 · Red Hat rating Important
    Red Hat Quay v3.6.0 security, bug fix and enhancement update
    • Quay v3 quay/quay-rhel8

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Quay v3Fixed RHSA-2021:3917
Not affected: 1 product
  • Quay v3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1010266
  2. 2026-10-03 Alias added: GHSA-x5rq-j2xg-h7qm

References

Advisory 4

Other 5

  • TI-2021-06035 Command injection in Lodash CVSS 3.1HIGH 7.2
  • TI-2026-04185 lodash vulnerable to Code Injection via `_.template` imports key names CVSS 3.1CRITICAL 9.8
  • TI-2019-08009 Prototype pollution in Snyk lodash CVSS 3.1CRITICAL 9.1
  • TI-2020-06621 Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20. CVSS 3.1HIGH 7.4
  • TI-2025-12309 Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions CVSS 4.0MEDIUM 6.9
  • TI-2020-17303 Regular expression denial of service (ReDoS) in Lodash CVSS 3.1MEDIUM 5.3
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences